CVE-2026-92539
Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise
CVSS Score
6.7
EPSS Score
0.0%
EPSS Percentile
0th
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
| CWE | CWE-639 CWE-863 CWE-1220 |
| Vendor | grafana |
| Product | grafana enterprise |
| Ecosystems | |
| Industries | Technology |
| Published | Oct 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for grafana grafana enterprise
Be the first to know when new medium vulnerabilities affecting grafana grafana enterprise are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Grafana / Grafana Enterprise
11.6.0 ≤ 12.3.11 12.4.0 < 12.4.13 13.0.0 < 13.0.11 13.1.0 < 13.1.8 13.2.0 < 13.2.4